Exactly.
Oval content to extend to other tools would be most welcome!
--
Shawn Wells
Director, Innovation Programs
shawn(a)redhat.com | 443.534.0130
@shawndwells
On Jul 28, 2015, at 7:50 PM, Trevor Vaughan
<tvaughan(a)onyxpoint.com> wrote:
I'm guessing it's because it comes with RHEL and is therefore supported and easy
to test out of the box.
If your local Security Officer is willing to allow it, you could use pretty much anything
in place of AIDE.
Trevor
> On Tue, Jul 28, 2015 at 6:50 PM, Bond Masuda <bond.masuda(a)hexadiam.com> wrote:
> I'm not sure if this is the place to talk about the specific content of the
security standards or if the SSG is more "meta"...
>
> I see there is a test Rule ID: package_aide_installed. I am inclined to think that
the spirit of this test is to have a file integrity monitoring (FIM) system. But why AIDE
specifically? There are a few options for FIM, but not too many that one couldn't
write tests to ensure that at least one of the handful of fully featured OSS FIM solutions
is installed and configured. (other options that come to mind are OSSEC and Samhain)
Additionally, AIDE development seems to be stagnant and perhaps not the best choice at
this time.
>
> Where is this guidance coming from? Is the source of the guidance really technology
specific or is the choice of AIDE just a specific interpretation of a more general
guidance for a FIM solution? What's the rationale, if so?
>
> -Bond
>
> --
> SCAP Security Guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
https://github.com/OpenSCAP/scap-security-guide/
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
-- This account not approved for unencrypted proprietary information --
--
SCAP Security Guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
https://github.com/OpenSCAP/scap-security-guide/